From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
To: hpa@zytor.com, tglx@linutronix.de, x86@kernel.org
Cc: Linux Kernel list <linux-kernel@vger.kernel.org>,
Ingo Molnar <mingo@elte.hu>,
linux-security-module@vger.kernel.org,
Ian Campbell <Ian.Campbell@eu.citrix.com>,
Kees Cook <kees.cook@canonical.com>,
matthieu castet <castet.matthieu@free.fr>
Subject: for tip-bugfix? Re: [PATCH] NX protection for kernel data : fix xen boot
Date: Wed, 2 Feb 2011 15:55:04 -0500 [thread overview]
Message-ID: <20110202205504.GA6936@dumpdata.com> (raw)
In-Reply-To: <4D41ED13.5020105@free.fr>
On Thu, Jan 27, 2011 at 11:09:23PM +0100, matthieu castet wrote:
> I think it should be applied before 2.6.38 release, because without
> this patch xen doesn't boot on x86_32 with CONFIG_DEBUG_RODATA.
>
Hey tglx + hpa,
The title is a bit wrong, the issue here is not with the NX bit
but with setting RW on RO areas in the .bss area.
I was wondering if you guys would be OK picking this up in your
"tip-2.6.38-rc4-bug-fix" branch for Linus? I've done the baremetal tests
on this patch (x86, x86_64) and have not found any regressions with it.
> >From 08f54ec4007ab0df231d81ed436632aa7f605feb Mon Sep 17 00:00:00 2001
> From: Matthieu CASTET <castet.matthieu@free.fr>
> Date: Thu, 20 Jan 2011 21:11:45 +0100
> Subject: [PATCH] NX protection for kernel data : fix xen boot
>
> Xen want page table pages read only.
>
> But the initial page table (from head_*.S) live in .data or .bss.
>
> That was broken by 64edc8ed5ffae999d8d413ba006850e9e34166cb.
> Revert the problematic part as it is only a protection and
> not really needed.
>
> Signed-off-by: Matthieu CASTET <castet.matthieu@free.fr>
> Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> ---
> arch/x86/mm/pageattr.c | 8 --------
> 1 files changed, 0 insertions(+), 8 deletions(-)
>
> diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
> index 2ad6c48..951eb4a 100644
> --- a/arch/x86/mm/pageattr.c
> +++ b/arch/x86/mm/pageattr.c
> @@ -256,7 +256,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
> unsigned long pfn)
> {
> pgprot_t forbidden = __pgprot(0);
> - pgprot_t required = __pgprot(0);
>
> /*
> * The BIOS area between 640k and 1Mb needs to be executable for
> @@ -286,12 +285,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
> if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
> __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
> pgprot_val(forbidden) |= _PAGE_RW;
> - /*
> - * .data and .bss should always be writable.
> - */
> - if (within(address, (unsigned long)_sdata, (unsigned long)_edata) ||
> - within(address, (unsigned long)__bss_start, (unsigned long)__bss_stop))
> - pgprot_val(required) |= _PAGE_RW;
>
> #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
> /*
> @@ -331,7 +324,6 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
> #endif
>
> prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
> - prot = __pgprot(pgprot_val(prot) | pgprot_val(required));
>
> return prot;
> }
> --
> 1.7.2.3
>
prev parent reply other threads:[~2011-02-02 20:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-27 22:09 [PATCH] NX protection for kernel data : fix xen boot matthieu castet
2011-02-02 20:55 ` Konrad Rzeszutek Wilk [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110202205504.GA6936@dumpdata.com \
--to=konrad.wilk@oracle.com \
--cc=Ian.Campbell@eu.citrix.com \
--cc=castet.matthieu@free.fr \
--cc=hpa@zytor.com \
--cc=kees.cook@canonical.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.